When data is deleted from a magnetic disk such as a hard drive, the data can often be recovered. A hard drive typically comprises many addressable “blocks,” or individual units of data. A file or other logical data storage unit typically comprises data written to the blocks and an entry in a file structure that includes pointers that point to the blocks storing the data. The delete function of many file systems only removes the pointers; the data itself remains intact. Even after a low-level format of a hard drive, data stored on the drive may be recoverable. In many applications, however, it may be undesirable for certain data (e.g., sensitive or confidential data) to remain recoverable after deletion. In such applications, it may be desirable to “sanitize” a mass storage device, such as a magnetic disk.
Generally, sanitization involves making the data blocks on the disk unreadable so that sensitive data is unrecoverable. Several techniques for “sanitizing” a magnetic disk are known today. One way to sanitize a hard drive is to physically destroy the drive. For example, the drive may be dismantled or otherwise physically altered. Another physical method is to degauss the disk by applying a powerful alternating magnetic field to the disk. The degaussing technique changes the orientation of the magnetic particles on the disk platter.
If the drive is to be reused, it can be sanitized by writing over the data already on the disk. This approach is known as “media overwrite” sanitization. Media overwrite sanitization may be as simple as writing logic zeros to every bit on a drive, or writing different predetermined or random patterns to the drive. Writing over the drive once is known as a “single pass” overwrite. Writing over the drive multiple times is known as “multiple pass” overwrite. Different users require different levels of sanitization. For example, a user storing sensitive information, such as confidential trade secrets, may want to perform a greater number of passes.
Several different “patterns” have been developed to perform media overwrite sanitization. A pattern is the sequence of bits (ones and zeros) that is written to the drive in order to prevent recovery of deleted data. The “Guttman” pattern is an example of a pattern used by many hard drive sanitization applications. Using a multiple pass overwrite, different patterns may be used for each pass. For example, the first pass may use a particular pattern, where the second pass may use the pattern's complement, and the third pass may use random data.
FIG. 1 illustrates an example of a system 100 that can be used for storing data. The system 100 includes a storage server 102 that manages a volume 104 which comprises one or more physical magnetic drives. The data stored in the volume 104 is encrypted. The encrypted data can only be accessed using an appropriate encryption key, which can be a random series of bits (typically between 40 and 512 bits) used to encode the data stored on the volume 104. The clients 106 may access the volume 104, to read to write data, through a cryptographic interface 108 and the storage server 102. The read and write requests and associated data are encrypted and decrypted by the cryptographic interface 108.
The volume 104 can be sanitized by discarding the encryption key, since the data on the volume 104 is unreadable without they key, and typical encryption standards (such as the advanced encryption standard (AES) encryption standards including AES-256 and AES-512) are computationally infeasible to compromise with currently existing technology. Removing the cryptographic interface 108 would provide further protection against undesired recovery of the deleted (encrypted) data.
A shortcoming of known sanitization techniques and system 100 is that they sanitize only at a disk-wide level of granularity. When a hard drive or other storage device is being retired or removed from use, the entire device (e.g., the entire disk drive) is sanitized to protect the data. However, in some instances, it may be desirable to sanitize only a portion of the disk drive. For example, storage users that are subject to government regulations regarding the retention of data may want to delete and sanitize only the particular files that the users are permitted to delete. The regulations may require that the user retain the other files. In some instances, it may be desirable to be able to sanitize only a portion of a file, e.g., only certain blocks. Further, in the system 100 of FIG. 1, the cryptographic interface 108 undesirably introduces additional hardware between the storage server 102 and the clients 106.